CVE-2025-25058: Intel Ethernet 800 ESXi Driver Flaw

CVE-2025-25058 Overview

CVE-2025-25058 is an improper initialization vulnerability [CWE-665] affecting Intel Ethernet 800-Series kernel mode drivers for VMware ESXi. The flaw exists in versions before 2.2.2.0 on ESXi 8.0 and before 2.2.3.0 on ESXi 9.0. The driver resides in Ring 1 (Device Drivers) and can expose information to an authenticated local user. Exploitation requires local access and low attack complexity, but no special internal knowledge and no user interaction. The impact is limited to confidentiality of the vulnerable component, with no effect on integrity or availability.

Critical Impact
An authenticated local user can trigger information disclosure from the Intel Ethernet 800-Series ESXi kernel driver due to improper initialization of driver memory.

Affected Products

Intel Ethernet 800-Series ESXi kernel mode driver versions before 2.2.2.0 on VMware ESXi 8.0
Intel Ethernet 800-Series ESXi kernel mode driver versions before 2.2.3.0 on VMware ESXi 9.0
Systems running affected Intel Ethernet 800-Series adapters under ESXi hypervisors

Discovery Timeline

2026-02-10 - CVE-2025-25058 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in the NVD database

Technical Details for CVE-2025-25058

Vulnerability Analysis

The vulnerability stems from improper initialization within the Intel Ethernet 800-Series ESXi kernel mode driver. The driver fails to fully initialize memory regions before exposing them to interfaces accessible from less privileged contexts. When uninitialized memory is read, residual data from prior kernel operations can leak to the calling process. This class of flaw is categorized under [CWE-665] (Improper Initialization).

Because the driver executes within Ring 1 device driver scope on ESXi, leaked content may contain kernel state, networking buffers, or other sensitive runtime data. The flaw does not allow code execution or modification of system state. Exploitation is constrained to local, authenticated contexts and yields confidentiality impact only on the vulnerable component itself.

The EPSS probability is approximately 0.018%, reflecting low likelihood of broad exploitation activity, consistent with the local access requirement and limited impact scope.

Root Cause

The driver allocates memory structures or response buffers without zeroing or fully populating them prior to returning data to user-accessible interfaces. Residual kernel memory contents persist in the unwritten regions and are subsequently observable by the requesting process.

Attack Vector

An unprivileged but authenticated local adversary interacts with the affected driver interface from a guest or management context on the ESXi host. The attacker repeatedly invokes the driver path that returns improperly initialized buffers and collects leaked memory contents. No user interaction is required, and the attack complexity is low, though specific attack requirements must be satisfied per the CVSS 4.0 vector. No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-25058

Indicators of Compromise

No public indicators of compromise have been published for CVE-2025-25058 at this time.
Absence of file-based artifacts is expected because exploitation reads memory rather than writing to disk.

Detection Strategies

Inventory ESXi hosts and identify deployed Intel Ethernet 800-Series driver versions. Flag any installation below 2.2.2.0 (ESXi 8.0) or 2.2.3.0 (ESXi 9.0).
Audit local authenticated sessions on ESXi hosts and correlate unexpected driver ioctl or management interface calls against established baselines.
Review hypervisor and driver logs for abnormal frequency of device driver queries originating from non-administrative accounts.

Monitoring Recommendations

Continuously monitor ESXi host patch state through configuration management and vulnerability scanners.
Alert on creation or elevation of local accounts on ESXi hosts that could satisfy the authenticated-access prerequisite.
Track Intel and Broadcom (VMware) advisory feeds for updated driver bundles and supersedence notices.

How to Mitigate CVE-2025-25058

Immediate Actions Required

Upgrade the Intel Ethernet 800-Series ESXi driver to version 2.2.2.0 or later on ESXi 8.0 hosts.
Upgrade the Intel Ethernet 800-Series ESXi driver to version 2.2.3.0 or later on ESXi 9.0 hosts.
Restrict local authenticated access on ESXi hosts to a minimum set of administrators.
Review the Intel Security Advisory SA-01408 for the authoritative remediation guidance.

Patch Information

Intel addresses CVE-2025-25058 in Intel Ethernet 800-Series ESXi kernel mode driver version 2.2.2.0 for ESXi 8.0 and 2.2.3.0 for ESXi 9.0. Apply the vendor-provided VMware Installation Bundle (VIB) using standard ESXi patch management workflows and reboot affected hosts to load the corrected driver. Refer to the Intel Security Advisory SA-01408 for download links and bundle identifiers.

Workarounds

Limit local logon and API access to ESXi hosts to trusted administrators until patched drivers are deployed.
Enforce strong authentication and role-based access control on ESXi management interfaces to reduce the pool of users who can satisfy the local authenticated access prerequisite.
Where operationally feasible, isolate ESXi management networks from general user access pending driver remediation.

bash

# Verify installed Intel Ethernet 800-Series driver version on ESXi
esxcli software vib list | grep -i icen

# Install updated driver VIB after staging it on the host
esxcli software vib update -d /vmfs/volumes/<datastore>/<intel-icen-driver-bundle>.zip

# Reboot to load the patched driver
reboot